В GNS была собрана схема работы L3VPN между Juniper (M/T) и Cisco 7200. Проблема в том что после обмена маршрутами по MP-BGP между железками, они попадают в нужные vrf, но ping из vrf так и не проходит. Данные настройки применялись на реальном железе, но результат не меняется.
Vrf vpna используется для получения маршрутов от оператора, по верх которых поднимается gre и строится свой vpn? т.е. vrf - vpnb.
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Denver
!
ip cef
no ip domain lookup
!
!
ip vrf vpna
rd 65000:1
route-target export 65000:10
route-target import 65000:10
!
ip vrf vpnb
rd 65000:3
route-target export 65000:11
route-target import 65000:11
!
ip ips po max-events 100
mpls label protocol ldp
no ftp-server write-enable
!
!
interface Tunnel1
ip address 40.0.0.2 255.255.255.252
ip router isis
mpls label protocol ldp
tag-switching ip
tunnel source 10.0.0.2
tunnel destination 10.0.0.1
tunnel vrf vpna
!
interface Loopback0
ip address 30.0.0.1 255.255.255.255
ip router isis
!
interface FastEthernet0/0
ip vrf forwarding vpna
ip address 10.0.0.2 255.255.255.252
duplex auto
speed auto
!
interface FastEthernet0/1
ip vrf forwarding vpnb
ip address 31.0.0.1 255.255.255.0
duplex auto
speed auto
!
router isis
net 49.0001.0001.0002.00
!
router bgp 65000
no synchronization
bgp log-neighbor-changes
neighbor 20.0.0.1 remote-as 65000
neighbor 20.0.0.1 update-source Loopback0
neighbor 20.0.0.1 soft-reconfiguration inbound
no auto-summary
!
address-family vpnv4
neighbor 20.0.0.1 activate
neighbor 20.0.0.1 send-community extended
exit-address-family
!
address-family ipv4 vrf vpnb
redistribute connected
no auto-summary
no synchronization
exit-address-family
!
address-family ipv4 vrf vpna
neighbor 10.0.0.1 remote-as 101
neighbor 10.0.0.1 local-as 102
neighbor 10.0.0.1 update-source FastEthernet0/0
neighbor 10.0.0.1 activate
no auto-summary
no synchronization
exit-address-family
!
ip classlessend
----------------------------------
root> show configuration
## Last commit: 2011-12-09 08:57:08 UTC by root
version 9.3R1.7;
-----
interfaces {
em0 {
unit 0 {
family inet {
address 10.0.0.1/30;
}
}
}
em1 {
unit 0 {
family inet {
address 21.0.0.1/24;
}
}
}
gre {
unit 0 {
tunnel {
source 10.0.0.1;
destination 10.0.0.2;
routing-instance {
destination vpna;
}
}
family inet {
address 40.0.0.1/30;
}
family iso;
family mpls;
}
}
lo0 {
unit 0 {
family inet {
address 20.0.0.1/32;
}
family iso {
address 49.0001.0001.0001.00;
}
}
}
}
protocols {
mpls {
interface gre.0;
}
bgp {
group vpnb {
type internal;
family inet {
unicast;
}
family inet-vpn {
unicast;
}
local-as 65000;
neighbor 30.0.0.1;
}
}
isis {
interface gre.0;
interface lo0.0;
}
ldp {
interface gre.0;
}
}
policy-options {
policy-statement export_vpna {
term 1 {
from protocol [ direct bgp ];
then {
community add com_vpna;
accept;
}
}
term 2 {
then reject;
}
}
policy-statement export_vpnb {
term 1 {
from protocol [ bgp direct ];
then {
community add com_vpnb;
accept;
}
}
term 2 {
then reject;
}
}
policy-statement import_vpna {
term 1 {
from {
protocol bgp;
community com_vpna;
}
then accept;
}
term 2 {
then reject;
}
}
policy-statement import_vpnb {
term 1 {
from {
protocol bgp;
community com_vpnb;
}
then accept;
}
term 2 {
then reject;
}
}
community com_vpna members target:65000:10;
community com_vpnb members target:65000:11;
}
routing-instances {
vpna {
instance-type vrf;
interface em0.0;
route-distinguisher 65000:2;
vrf-import import_vpna;
vrf-export export_vpna;
vrf-table-label;
protocols {
bgp {
group vpna {
type external;
local-address 10.0.0.1;
peer-as 102;
local-as 101;
neighbor 10.0.0.2;
}
}
}
}
vpnb {
instance-type vrf;
interface em1.0;
route-distinguisher 65000:3;
vrf-import import_vpnb;
vrf-export export_vpnb;
vrf-table-label;
}
}
root> show route table vpnb.inet.0 detailvpnb.inet.0: 3 destinations, 3 routes (3 active, 0 holddown, 0 hidden)
21.0.0.0/24 (1 entry, 1 announced)
*Direct Preference: 0
Next hop type: Interface
Next-hop reference count: 1
Next hop: via em1.0, selected
State: <Active Int>
Age: 1:18:37
Task: IF
Announcement bits (1): 1-BGP RT Background
AS path: I21.0.0.1/32 (1 entry, 0 announced)
*Local Preference: 0
Next hop type: Local
Next-hop reference count: 4
Interface: em1.0
State: <Active NoReadvrt Int>
Age: 1:18:37
Task: IF
AS path: I31.0.0.0/24 (1 entry, 1 announced)
*BGP Preference: 170/-101
Route Distinguisher: 65000:3
Next hop type: Indirect
Next-hop reference count: 3
Source: 30.0.0.1
Next hop type: Router, Next hop index: 575
Next hop: via gre.0, selected
Label operation: Push 18
Protocol next hop: 30.0.0.1
Push 18
Indirect next hop: 8c3e000 131070
State: <Secondary Active Int Ext>
Peer AS: 65000
Age: 46:53 Metric: 0 Metric2: 1
Task: BGP_65000_65000.30.0.0.1+14880
Announcement bits (1): 0-KRT
AS path: ?
Communities: target:65000:11
Accepted
VPN Label: 18
Localpref: 100
Router ID: 30.0.0.1
Primary Routing Table bgp.l3vpn.0
Denver#show ip route vrf vpnb21.0.0.0/24 is subnetted, 1 subnets
B 21.0.0.0 [200/0] via 20.0.0.1, 00:47:53
31.0.0.0/24 is subnetted, 1 subnets
C 31.0.0.0 is directly connected, FastEthernet0/1Если запустить ping на june
root> ping 31.0.0.1 routing-instance vpnb source 21.0.0.1
PING 31.0.0.1 (31.0.0.1): 56 data bytes, а на cisco включить debug ip icmp, то она выдает следующее:
*Dec 9 13:49:51.283: ICMP: echo reply sent, src 31.0.0.1, dst 21.0.0.1
*Dec 9 13:49:52.407: ICMP: echo reply sent, src 31.0.0.1, dst 21.0.0.1
*Dec 9 13:49:53.439: ICMP: echo reply sent, src 31.0.0.1, dst 21.0.0.1
интересно, а какой иос вы использовали в gns3?
> интересно, а какой иос вы использовали в gns3?В GNC на Cisco брал (C7200-JK9O3S-M). Когда пробовал на реальном железе, то это была 3845 с c3845-adventerprisek9_ivs-mz.124-20.T, картина не менялась.
>> интересно, а какой иос вы использовали в gns3?
> В GNC на Cisco брал (C7200-JK9O3S-M). Когда пробовал на реальном железе, то
> это была 3845 с c3845-adventerprisek9_ivs-mz.124-20.T, картина не менялась.В тоже время, схема работает между cisco 7200 - cisco 7200, где-то проблема в совместимости оборудования, по моему.